Fact-Check Insights and MediaVault Privacy Policy

Effective: December 2025

1. Identification of the Joint Controllers

In accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018, and other applicable legislation, the user is informed that the personal data provided through MediaVault access and management forms will be jointly processed by:

Fundación Maldita.es contra la desinformación: periodismo, educación, investigación y datos en nuevos formatos
Tax ID: G88519038
Address: Avenida de Manzanares, 196, local 2, Madrid (28026).
Contact: contacto@maldita.es

Full Fact
Registered charity: 1158683
Address: 7 Oval Way, SE115RR, London, United Kingdom
Contact: mediavault@fullfact.org

Both organizations act as joint controllers, under a joint responsibility agreement, and jointly manage the MediaVault platform.

For clarification, it is reported that registration on the MediaVault platform implies that Maldita and Full Fact will access the personal data provided as joint controllers. Full Fact is based in London (United Kingdom), considered by the European Commission as a country with a level of protection equivalent to that of the European Union according to Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, regarding the adequate protection of personal data by the United Kingdom.

2. Purpose of the Processing

The personal data collected will be processed exclusively for the following purposes:

  • Managing access to the MediaVault tool by fact-checking organizations.
  • Facilitating the download and upload of content, including ClaimReview and MediaReview.
  • Handling opt-out requests from users or interested third parties.

No processing will be carried out for purposes other than those expressly indicated.

3. Categories of Data

The personal data that may be processed are:

  • Identification and contact data (name, email, organization).
  • Information on the use of the tool (archived content, links, classifications).

4. Data Source

The personal data are collected only through:

  • The MediaVault access form.
  • The opt-out form.

Likewise, data transferred from GUESSWORK,INC the previous controller of the platform, will be incorporated. Existing users will be formally notified about the change of controllers and the privacy policy.

5. Legal Basis for Processing

The legal basis for the data processing is:

  • Consent of the data subject (Art. 6.1.a GDPR).
  • Performance of a contract or pre-contractual relationship (Art. 6.1.b GDPR), when the user requests access to the tool and accepts its terms and conditions of use.
  • Legitimate interest of the joint controllers in managing a collaborative tool for the archiving and analysis of disinformation (Art. 6.1.f GDPR).

6. Data Recipients

User registration data: Only accessible by Maldita.es and Full Fact.

Personal data will not be disclosed to third parties, except in cases of legal obligation or legitimate request by a competent authority.

7. Data Processors

The joint controllers may use external providers for IT infrastructure and storage services, such as servers located in the European Union. These companies will act as data processors without active access to personal data.

It will be ensured that these providers offer an adequate level of protection in accordance with Article 28 of the GDPR.

8. International Transfers

MediaVault is a tool for international use. However, servers and legal compliance are within the European Economic Area, and user registration data are not transferred to third countries.

If any international data transfer outside the EEA occurs, it will be carried out with the appropriate safeguards provided for in Article 46 of the GDPR, such as standard contractual clauses.

9. Retention Period

Personal data will be retained:

  • While the relationship with the user and access to MediaVault is maintained.
  • Once the relationship with the user ends, the data will be blocked while legal liabilities may arise, so they will only be accessible to judges, courts, and competent authorities.
  • Subsequently, the data will be completely deleted.

In any case, the data will not be kept for a period longer than 5 years.

10. Rights of Data Subjects

Within the limits and conditions permitted by current legislation, users may exercise the following rights before any of the joint controllers:

  • Access: obtain information on whether their personal data is being processed, the subject, and purposes of the processing.
  • Rectification: request the correction and modification of inaccurate data.
  • Erasure (right to be forgotten): complete deletion of data, which may be carried out when: (i) your data are no longer necessary for the purposes for which they were collected; (ii) you withdraw your consent and there is no other legal basis for the processing; (iii) you object to the processing of your data and there is no legitimate reason for processing; (iv) it has been established that your data have been processed unlawfully; (v) the data must be deleted to comply with a legal obligation.
  • Objection: to the processing of personal data for specific purposes where appropriate.
  • Restriction of processing: meaning we may not use your Personal Data for a defined period. You may exercise this right when: (i) you contest the accuracy of your data during a period allowing us to verify their accuracy; (ii) the processing is unlawful and you oppose the deletion of your data and instead request their restriction; (iii) the data are no longer necessary for use of the tool but still required for the establishment, exercise or defense of legal claims; (iv) you object to the processing for reasons related to your particular situation while we verify whether the legitimate reasons pursued by MediaVault override those of the user.
  • Data portability: receive your personal data provided or request that we communicate them to a third party when the processing (i) has been carried out by automated means and (ii) is based on your consent or a contract.
  • Not to be subject to automated individual decision-making.

To exercise these rights, you may send your request to the following email: mediavault-contact@fullfact.org

You may also file a complaint with the Spanish Data Protection Agency (AEPD) in Madrid, Calle Jorge Juan, 6 or online at www.agpd.es.

11. No Automated Decisions

No automated decisions will be made, nor will profiles be created that produce legal or significant effects for the user.

12. Security

The joint controllers will apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including data encryption, access control, and traceability mechanisms.

13. Policy Changes

This policy may be updated due to legislative, technical, or functional changes. Changes will be clearly notified to already registered users with sufficient time to review them.